Phishing Attacks
We do not count clicks. We take the click and keep going, through your environment toward the systems that matter, so you find out what a phishing email is actually worth to an attacker.
This is not a phishing simulation tool
There are plenty of phishing simulation platforms. They send templated emails to your staff, count who clicks, and enrol the ones who did into an e-learning module. They are inexpensive, they produce a percentage, and for some organisations that is enough.
That is not what this is.
CREDS runs authorised phishing attacks against your organisation, built by the same people who run our red team engagements. The emails are written for your organisation rather than pulled from a library. The scenarios come from reconnaissance on your actual business. And when someone falls for one, we do what a real attacker would do next: we use it.
The output is not a click rate. It is a demonstration of what a phishing email leads to in your environment.
A phishing simulation platform
A CREDS phishing engagement
Templated emails from a content library
Scenarios written for your organisation, built on reconnaissance
Stops at the click or the credential
Continues into your environment toward your crown jewels
Reports a click percentage
Reports what an attacker could reach, and whether anyone noticed
Enrols the user in e-learning
Shows the organisation what the click actually costs
Email only
Email, telephone, SMS, QR, MFA abuse and physical
What happens after someone falls for it
For most phishing exercises, a click is the end of the test. For us it is the beginning of the interesting part.
When one of our emails yields credentials, or when someone executes our friendly malware, we move to the next phase: we use what we have. We authenticate with the credentials. We work from the foothold the malware gave us. From there we do exactly what an attacker would: escalate privileges, move laterally, and work toward the systems and data your organisation actually depends on.
Those crown jewels are agreed with you before we start. The objective is not to see how far we can get in the abstract, but to answer a specific question: if one person in your organisation has a bad morning, what does that put at risk?
That is a fundamentally different answer from a percentage. A click rate tells you how many people were fooled. This tells you what being fooled costs.
This is also why a phishing engagement with CREDS is not only a test of your employees. It is a test of everything that was supposed to contain the damage afterwards: your segmentation, your privilege model, your conditional access, and your detection.
Scenarios built from what an attacker could find out about you
Real phishing that works is not generic. It refers to a project that is genuinely running, arrives from a supplier you genuinely use, or lands in the week when the thing it references is genuinely happening.
Every CREDS phishing engagement starts with open source intelligence on your organisation: what is publicly discoverable about your people, your structure, your suppliers, your technology and the events in your calendar. That reconnaissance shapes both the scenarios we build and the individual emails we write.
It is the same OSINT work that opens a red team engagement, applied at a smaller scale, and it is the difference between an email your staff have been trained to spot and one they have no particular reason to doubt.
OSINT scope is agreed with you before reconnaissance begins. It may include publicly visible personal social media, because a real attacker would use it. Whatever is in scope is documented before we start, which is usually what a works council wants to see.
Phishing is not only email any more
Attackers go where the defences are weakest, and for most organisations that is no longer the inbox. We run the channels that are actually being used against organisations like yours.
Email phishing
Targeted campaigns written for your organisation, from broad to individually crafted.
Spear phishing
Individually researched emails aimed at specific people, typically executives, finance or IT administrators.
Vishing (telephone)
Voice calls impersonating IT support, a supplier or a colleague. Consistently the highest-yield channel, and the one organisations test least.
Smishing (SMS)
Text-based approaches, which bypass email security entirely and land on personal devices.
QR-code phishing
Codes in emails, documents or printed material that move the victim onto an unmanaged phone outside your controls.
MFA fatigue and consent phishing
Push-notification bombardment and malicious OAuth consent requests, the techniques attackers now use specifically to defeat multi-factor authentication.
Physical approaches, such as attending your premises in person, are available within a red team engagement rather than a phishing engagement.
How we treat your people
Phishing engagements make organisations uncomfortable, and they should. You are authorising us to deceive your colleagues and, when it works, to use their credentials. That deserves clear rules, agreed before anything starts.
No individual is named. Results are reported in aggregate. We report how many people in a group engaged, not who.
Results are never used for disciplinary purposes. This is agreed in writing before the engagement. The exercise measures the organisation, not the individual.
Credentials are handled under a defined policy. Any credentials captured are stored securely for the duration of the engagement, used only within the agreed scope, and destroyed at closure. We tell you which accounts were affected so you can force a reset.
The engagement is designed with your works council in mind. We can supply the scoping documentation Dutch organisations typically need for consultation with the ondernemingsraad, and we will advise on what is and is not appropriate to test.
Data handling is documented. What we collect, where it is held, who has access and how long it is retained, under GDPR.
The point of a phishing engagement is to find out whether your organisation can absorb a mistake. Treating the person who made it as the problem defeats the exercise.
Beyond the click rate
Click rate is the metric everyone quotes and the least useful one. It tells you how many people were deceived, not whether your organisation could cope.
Report rate
How many people recognised the attack and reported it. The single most useful number on the page, because it measures whether your reporting culture works rather than which individuals failed.
Time to first report
How long between the first delivery and the first person raising the alarm. This determines whether a real attack would have been contained.
Credential submission rate
How many went past the click to actually hand over credentials.
Post-compromise reach
How far we got with what we obtained, which systems we could access, and how close we came to your crown jewels.
Detection and response
Whether your SOC or security tooling noticed the credential being used, the malware executing, or the lateral movement afterwards.
The last two are the ones a phishing platform cannot give you, and they are usually the ones that change what you do next.
Everything we did, and everything that happened
You receive a full report of the engagement: the scenarios we built and why, what was sent to whom, what happened at each stage, how far the post-compromise phase progressed, and what we recommend changing.
Alongside it, the CREDS client portal gives you live insight while the engagement is running, with the full telemetry behind it: delivery, engagement, credential submission, reporting activity and the post-compromise steps, as they happen rather than weeks later.
That matters during a campaign as well as after it. If reporting activity spikes, you know your people are working. If a serious foothold opens up, you know immediately rather than at the closing meeting.
- Full engagement report, including scenario rationale and post-compromise findings
- Live findings and full telemetry in the client portal throughout the engagement
- Immediate notification of any serious foothold or exposure
- Aggregate results suitable for sharing internally, with no individuals identified
- A prioritised set of recommendations covering both the human and the technical controls that failed
- Trend reporting across campaigns, where the engagement is part of an ongoing programme
One test gives you a number. A programme gives you a direction.
A single phishing engagement tells you where you stood on one particular week, against one particular set of scenarios. It is a useful number, and it is only a number.
What organisations actually need to know is whether things are getting better: whether reporting is rising, whether time to report is falling, whether the controls that failed last time hold this time, and whether the people who were caught by a supplier-impersonation scenario in March still are in September.
So we recommend treating the first engagement as a baseline and running campaigns at intervals afterwards, varying the channel, the scenario and the difficulty, so you are measuring resilience rather than familiarity with one particular email.
The portal carries the trend across campaigns, so the picture builds rather than resetting each time.
In practice that means quarterly campaigns after the baseline, available as an ongoing subscription rather than something you have to re-scope each time.
Training is not what we do, and that is deliberate
We test. We do not run awareness programmes, e-learning platforms or behaviour-change consultancy, and we would rather say so than pretend otherwise.
What we do have is partners who do this well, and we work with them where a phishing engagement shows that training is what your organisation needs. The testing tells you where the gaps actually are, the training addresses them, and the next campaign tells you whether it worked.
If you already have an awareness programme or platform in place, our findings feed into it. If you do not, we can introduce you to a partner who does.
Questions about phishing engagements
Is this a phishing simulation platform?
What happens when someone falls for it?
Will individual employees be named in the report?
What happens to the passwords you capture?
Do we need to involve our works council?
Which channels do you use?
Do you provide awareness training afterwards?
How often should we run this?
What do we actually receive?
How is this different from the phishing our red team engagement includes?
Find out what a click is actually worth
Tell us about your organisation and what you are worried about, and we will scope an engagement, from a single baseline campaign to an ongoing programme.